CVE-2026-78482

Dell Secure Connect Gateway (SCG) 5.0, in both its Appliance and Application forms, contains an OS command injection flaw (improper neutralization of special elements passed to operating system commands; the record's CWE tag lists CWE-89, but the described flaw type is OS command injection). An attacker who already holds low-privileged access on the SCG host, such as a local user or a limited management session, can inject special characters into a command handled by the software, causing an attacker-controlled command to execute. Successful exploitation results in command execution on the gateway host, which the CVSS scoring rates as high impact for confidentiality, integrity, and availability. Only deployments of SCG 5.0 Appliance prior to 5.36.00.16 and SCG 5.0 Application prior to 5.36.00.00 are affected by this record; other Dell products and SCG versions are not implicated. As of this entry there is no known public proof-of-concept, the flaw is not in CISA's KEV, and no exploitation in the wild has been reported.

What to do: Upgrade Dell SCG 5.0 Appliance to 5.36.00.16 or later and Dell SCG 5.0 Application to 5.36.00.00 or later; verify your currently deployed version via the SCG administration interface before patching. Because exploitation requires low-privileged local access, restrict console, SSH, and management-plane access to the SCG host or appliance to trusted administrators as an interim mitigation. With no public PoC or known exploitation, standard patch-cycle remediation is sufficient.